Date field comparison

[alexandrebas]

I need help regarding comparise a ISO 8601 date field with a specific date.

Below is a simple example:

index=devices | table device_last_seen

Results:

device_last_seen

2022-01-21T13:09:58Z

2022-01-21T13:10:06Z

2022-01-17T14:56:00Z

2022-01-16T10:57:18Z

My goal is to show only the devices reported in the last 24h. It should be like this:

device_last_seen

2022-01-21T13:09:58Z

2022-01-21T13:10:06Z

However the search below didn´t return any results.

index=devices
| eval last24h=relative_time(now(), "-1d")
| where device_last_seen > last24h
| table device_last_seen

Thank in advance for your help.

[richgalloway · Accepted solution]

Dates can only be compared in integer form.  Use the strptime function to convert them to integers and then compare them.

index=devices
| eval last24h=relative_time(now(), "-1d")
| eval dls = strptime(device_last_seen, "%Y-%m-%dT%H:%M:%S%Z")
| where dls > last24h
| table device_last_seen